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As a method of allowing the firewall 103 to realize such a security 
function, there is a method such as packet filtering. This packet filtering is 
performed as follows, for example. That is to say, as to a packet sent from 
the server 104 or the client 101, the firewall 103 determines whether to allow 
the packet to pass through, based on the IP address, the port number, etc, of 
the packet, the port number indicating the type of higher-ranked 
applications. A packet that is allowed to pass through is transferred to a 
counterpart as it is. 
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(57)Abstract: 

PROBLEM TO BE SOLVED: To enhance the security of clients 
in a filtering processing device. 

SOLUTION: The filtering processing device 3 is provided 
between a client 1 and a sever 4 to filter data sent/ received 
between them. The filtering processing device 3 is provided with 
an analysis processing section 6 and a dynamic condition 
setting processing section 7. The analysis processing section 6 
analyzes data sent from the client 1 to the server 4. The 
dynamic condition setting processing section 7 sets a filtering 
conditions as to data sent from the server 4 to the client 1 on 
the basis of the analysis result by the analysis processing 
section 6. 
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[0045] (A) In a case where a bandwidth reservation request arrives from a 
bandwidth reservation protocol of another router under such a condition that 
all bandwidths of routes between routers are used for transmitting packets, 
the router negotiates with an adjacent router, if the adjacent router is one 
according to this invention, to request use of one of sub-routes between them 
for the bandwidth reservation. If the adjacent router is a conventional one, 
the router performs a process according to a general RSVP. 
[0046] (B) If a sub -route for the bandwidth reservation is set between the 
routers as a result of the negotiation, the router changes a routing table. In 
a general case of RSVP, the routing table contains destination IP address 
(network address), source IP address, destination port number, source port 
number, IP address of next router, and interface for next router (packet 
transfer means in this specification). 

[0047] In this embodiment, as sub-route to a next router, there are plural 
routes, not one route. Therefore, the routing table specifies a plurality of 
output side packet transfer means. At the time of bandwidth reservation, 
the routing table is changed so as to specify an output side packet transfer 
means connected to a corresponding sub-route for a packet flow (one of 
entries of routing table) that needs bandwidth reservation. 
[0048] (C) In a case where the bandwidth reservation can be made as a 
result of the negotiation (in a case where a sub-route for bandwidth 
reservation cannot be set between the routers), the transmission side 
transmits the packet by using an output-side packet transfer means for the 
sub-route set for the bandwidth reservation, and the receiving side receives 
the signal by using an input-side packet transfer means corresponding to the 
reserved sub-route. 

(D) The reserved bandwidth becomes free because of a bandwidth release 
process by the bandwidth reservation protocol or time-out, and then all 
bandwidths between the routers can be used as usual. 
[0049] 

Next, an example of an operation flow in a case of using a method for 
unexplicitly performing bandwidth reservation will be described. In 
general, a bandwidth reservation protocol informs the router of a bandwidth 
reservation request, an above-described operation to keep a sub -route is 
performed for the bandwidth reservation in response to the request. By 
applying the same operation to high-priority packets, high throughput can 
be realized in an entire network. 
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